Crossfire over messaging security

Martin Shelton

Principal Researcher

Illustration by Freedom of the Press Foundation. (CC BY 4.0)

It’s the Digital Security Training team at Freedom of the Press Foundation (FPF), with security news that keeps you, your sources, and your devices safe. If someone has shared this newsletter with you, please subscribe here.

In the news

Time for some security nerd drama, this time concerning the messaging apps Signal and Telegram. In recent weeks, Pavel Durov, the founder of messaging app Telegram, has been dialing up assertions on his competing platform about the security properties of the encrypted messaging app, Signal. Without evidence, Elon Musk, on his social platform X, also claimed there exist “known vulnerabilities” within the Signal app that are “not being addressed.”

Get Notified. Take Action.

Signal’s President Meredith Whittaker responded to these claims, suggesting “we don’t have evidence of extant vulnerabilities and haven’t been notified of anything,” and explained how security researchers can get in touch to help the team address any security issues if they are found.

Johns Hopkins cryptography professor Matthew Green explains that “the cryptography behind Signal (also used in WhatsApp and several other messengers) is open source and has been intensively reviewed by cryptographers. When it comes to cryptography, this is pretty much the gold standard.” By comparison, Telegram does not provide end-to-end encryption protection by default and only offers it as an option in one-on-one “Secret Chat” mode.

What you can do

  • For all of the reasons named in Green’s explainer above, our digital security training team often recommends Signal to journalists. Indeed, FPF served as fiscal sponsor of Signal until 2019.
  • Telegram enables large public channels that are not end-to-end encrypted, while Signal universally encrypts conversations for a more constrained group of people. These apps therefore serve very different purposes. The specific focus on private communications in groups of trusted people is one important reason we so often highlight Signal. Even with strong encryption, if you are sending messages to large groups of unknown people, all privacy bets are off. Read our guides to Signal for beginners and Locking down Signal.
  • To learn more about how to use a variety of other encrypted chat tools beyond Signal, check out our guides to secure communication.

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,
Martin

Donate to support press freedom

Your support is more important than ever.

Read more about Digital Security Digest

Apple's password app

In the hope of simplifying how customers can log into apps and websites, Apple has announced it will offer a new Passwords app in its upcoming versions of iOS 18, iPadOS 18, and macOS 15.

Oops, all breaches!

Data breach notification service “Have I Been Pwned?” has added the login information associated with 361 million email addresses. Have I Been Pwned owner Troy Hunt says as many as 151 million of these unique email addresses have never been seen in his database before. The website boasts tracking over 13.5 billion breach accounts. Some of these credentials are reportedly harvested from users’ devices infected with information-stealing malware.

Slack trains AI models on user data

Over this past week, Slack published a blog post defending its privacy practices following widespread criticism over its use of customer data to train its global AI models. At the moment, organizations are required to opt out to prevent their messages, content, and files from being mined to develop Slack’s AI.